F5 BIG-IP

10 known vulnerabilities in F5 BIG-IP, 7 critical, 8 actively exploited, with patch priority, exploit likelihood and the news covering them.

Recently exploited

  • CVE-2026-94127 CVSS 9.3 critical · actively exploited F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability
  • CVE-2025-53521 CVSS 9.3 critical · actively exploited F5 BIG-IP Stack-Based Buffer Overflow Vulnerability
  • CVE-2023-46748 CVSS 8.8 high · actively exploited F5 BIG-IP Configuration Utility SQL Injection Vulnerability
  • CVE-2023-46747 CVSS 9.8 critical · actively exploited F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability
  • CVE-2022-1388 CVSS 9.8 critical · actively exploited F5 BIG-IP Missing Authentication Vulnerability
  • CVE-2021-22991 CVSS 9.8 critical · actively exploited F5 BIG-IP Traffic Management Microkernel Buffer Overflow
  • CVE-2021-22986 CVSS 9.8 critical · actively exploited F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability
  • CVE-2020-5902 CVSS 9.8 critical · actively exploited F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability

Latest vulnerabilities

  • CVE-2026-94127 CVSS 9.3 critical · actively exploited F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability
  • CVE-2026-66842 CVSS 8.7 high BIG-IP has a vulnerability where an authenticated user of any role may be able to create administrative user accounts through an…
  • CVE-2026-63020 CVSS 2.3 low A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages Impact: An…
  • CVE-2025-53521 CVSS 9.3 critical · actively exploited F5 BIG-IP Stack-Based Buffer Overflow Vulnerability
  • CVE-2023-46748 CVSS 8.8 high · actively exploited F5 BIG-IP Configuration Utility SQL Injection Vulnerability
  • CVE-2023-46747 CVSS 9.8 critical · actively exploited F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability
  • CVE-2022-1388 CVSS 9.8 critical · actively exploited F5 BIG-IP Missing Authentication Vulnerability
  • CVE-2021-22991 CVSS 9.8 critical · actively exploited F5 BIG-IP Traffic Management Microkernel Buffer Overflow
  • CVE-2021-22986 CVSS 9.8 critical · actively exploited F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability
  • CVE-2020-5902 CVSS 9.8 critical · actively exploited F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability